Which wp-config.php settings are worth knowing and how do I set them safely?

Put constants before the line /* That's all, stop editing! Happy publishing. */, because wp-settings.php loads right after it.

// Debugging (see white-screen topic)
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );

// Security
define( 'DISALLOW_FILE_EDIT', true );        // no code editor in admin
define( 'DISALLOW_FILE_MODS', false );       // true blocks all installs and updates
define( 'FORCE_SSL_ADMIN', true );

// Performance
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_POST_REVISIONS', 5 );
define( 'EMPTY_TRASH_DAYS', 14 );
define( 'WP_CACHE', true );                  // set by caching plugins

// Cron: use a real system cron instead of page-load triggered cron
define( 'DISABLE_WP_CRON', true );

// Updates
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

// URLs (override DB values; handy during migrations)
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

// Environment type (WP 5.5+): local, development, staging, production
define( 'WP_ENVIRONMENT_TYPE', 'production' );

Behind a reverse proxy or load balancer that terminates SSL, WordPress may think the request is HTTP and loop redirects:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

Only do this if the proxy is trusted and strips client-supplied values.

Tips

• Keep the file out of version control or load secrets from environment variables.
• If you set DISABLE_WP_CRON, add a system cron entry such as */5 * * * * wp cron event run --due-now --path=/var/www/site, otherwise scheduled posts and emails stop.
• After a syntax slip in this file the whole site fails, so always keep a backup copy.